What is the NIST AI RMF?
The Artificial Intelligence Risk Management Framework (AI RMF) is a voluntary framework published by the US National Institute of Standards and Technology to help organisations manage risks to individuals, organisations and society associated with AI. NIST released version 1.0 as NIST AI 100-1 in January 2023, after public consultation, and supports it with an online Playbook of suggested actions.
The framework is non-sector-specific and use-case agnostic. It applies to organisations designing, developing, deploying, evaluating or using AI systems.
Purpose and objectives
The AI RMF aims to build trustworthiness considerations into AI products, services and systems by:
- giving a common vocabulary for AI risk;
- helping organisations decide which risks matter for a given context;
- encouraging measurement and documentation rather than assumptions;
- making AI risk management part of wider enterprise risk management.
Who does it apply to?
Anyone in the AI life cycle, whom NIST calls AI actors: model developers, system integrators, deployers, operators, evaluators, procurement teams and affected communities. Because it is voluntary and flexible, it suits small teams experimenting with AI as well as large enterprises and public bodies.
The characteristics of trustworthy AI
Part 1 of the framework describes characteristics of trustworthy AI systems. The framework treats them as dimensions that must be balanced against each other, not as a checklist:
| Characteristic | In plain terms |
|---|---|
| Valid and reliable | The system does what it is meant to, consistently, in its intended conditions |
| Safe | It does not, under defined conditions, lead to endangering human life, health, property or the environment |
| Secure and resilient | It withstands attacks and unexpected changes, and recovers |
| Accountable and transparent | Information about the system and its outputs is available to the right people, and someone is responsible |
| Explainable and interpretable | People can understand how outputs are produced and what they mean |
| Privacy-enhanced | Human autonomy, identity and dignity are protected through privacy safeguards |
| Fair, with harmful bias managed | Harmful bias and discrimination are identified and addressed |
Validity and reliability underpin the others. Accountability and transparency relate to all of them.
The AI RMF Core
Part 2 sets out the Core: four functions, each broken into categories and subcategories.
| Function | Purpose |
|---|---|
| Govern | Cross-cutting. Builds a culture of risk management: policies, roles, accountability, workforce diversity and engagement with stakeholders |
| Map | Establishes context: the system’s purpose, users, benefits, potential impacts and the risks that follow from them |
| Measure | Uses quantitative and qualitative methods to analyse, assess, benchmark and monitor AI risks and trustworthiness |
| Manage | Allocates resources to the risks that were mapped and measured: prioritising, responding, recovering and communicating |
The functions are not a linear sequence. Govern informs the others throughout, and Map, Measure and Manage repeat as systems and contexts change.
Profiles
A profile applies the Core to a particular setting, such as a sector, a use case or a technology. Organisations can describe a current profile (where they are) and a target profile (where they want to be). NIST’s Generative AI Profile (NIST AI 600-1) is an important example. It catalogues risks such as confabulation, information integrity, harmful content, data privacy, intellectual property, value-chain and component integration, and suggests actions mapped to the Core.
Key terminology
| Term | Meaning |
|---|---|
| AI system | An engineered or machine-based system that generates outputs such as predictions, recommendations or decisions for a given set of objectives, operating with varying levels of autonomy |
| AI actors | Everyone who plays a part in the AI life cycle, including affected individuals and communities |
| Risk | The composite of the probability of an event and the magnitude of its consequences, positive or negative |
| Risk tolerance | The organisation’s readiness to bear risk in order to achieve its objectives |
| Residual risk | Risk remaining after treatment, which should be documented and accepted |
| TEVV | Test, evaluation, verification and validation: the activities that show whether a system performs as intended |
Implementation lifecycle
- Establish governance. Policies, accountable roles and a risk tolerance for AI.
- Inventory and map. For each AI system, document its purpose, context, stakeholders, benefits and potential harms.
- Choose measures. Select metrics and test methods suited to the system, such as performance across groups, robustness and security testing.
- Manage and respond. Decide on treatment, deployment conditions, monitoring, and decommissioning criteria.
- Document and communicate. Keep records that let others understand and challenge decisions.
- Iterate. Revisit the profile as systems, data and regulation change.
Evidence and documentation concepts
Although nothing is audited against the AI RMF itself, organisations using it typically keep:
- an AI system inventory with owners and intended uses;
- context and impact documentation (the output of Map);
- test and evaluation plans and results, including red-teaming where relevant;
- risk registers and treatment decisions;
- monitoring records, incident logs and decommissioning decisions;
- records of stakeholder engagement and feedback.
Governance and accountability
The Govern function asks senior leadership to take responsibility for AI risk decisions and to make roles clear across the life cycle. It also asks organisations to consider the diversity of the teams involved and to put in place mechanisms for external feedback, so that affected people can raise concerns.
Common misconceptions and pitfalls
- “It’s a compliance checklist.” The subcategories are outcomes to consider, not mandatory controls.
- Treating it as only a security framework. Security is one characteristic among several.
- Measuring without mapping. Picking metrics before understanding context leads to measuring the wrong things.
- No feedback loop. The framework assumes continuous revisiting. A one-off assessment goes stale quickly.
Relationship with other frameworks
| Framework | Relationship |
|---|---|
| ISO/IEC 42001 | A certifiable AI management system. The AI RMF can inform its risk and impact processes. NIST has published crosswalks between the two |
| EU AI Act | Binding EU law. The AI RMF can support documentation and risk practices but does not demonstrate legal conformity |
| NIST CSF 2.0 | The cybersecurity counterpart, with a similar function and profile structure |
| ISO/IEC 23894 | International guidance on AI risk management with similar aims |
Open questions and items to watch
Points that were unsettled, contested or likely to change when this page was last reviewed. Check the official sources before relying on them.
- US federal AI policy changed during 2025, and NIST was directed to revise parts of the AI RMF. Check the NIST programme page for any revised version before relying on the 1.0 text for federal work.
- NIST continues to publish AI security guidance (for example, control overlays for AI systems). Treat those as companion material and confirm their final status on csrc.nist.gov.
Frequently asked questions
Is the NIST AI RMF mandatory?
No. NIST describes the AI RMF as voluntary. Organisations adopt it by choice, although public-sector policies, procurement requirements or contracts may reference it. It does not create legal obligations on its own.
Can we be certified against the NIST AI RMF?
No. NIST does not certify organisations, and the AI RMF has no conformity assessment scheme. Organisations wanting a certifiable AI governance standard typically look at ISO/IEC 42001, and often use the AI RMF alongside it.
What is the Generative AI Profile?
NIST AI 600-1, published in July 2024, is a companion profile for generative AI. It describes risks that are novel to or made worse by generative AI, such as confabulation and harmful content, and suggests actions mapped to the AI RMF functions.
How does the AI RMF relate to the NIST Cybersecurity Framework?
Both are voluntary, outcome-oriented NIST frameworks with a core of functions, categories and subcategories, and both use profiles. The CSF focuses on cybersecurity risk, while the AI RMF covers broader AI risks, including safety, fairness, explainability and privacy. Security of AI systems sits in both.
Sources and official references
- AI Risk Management Framework (programme page) — National Institute of Standards and Technology (NIST) (official source)
- NIST AI 100-1: Artificial Intelligence Risk Management Framework (AI RMF 1.0) — NIST (official source)
- NIST AI 600-1: AI RMF Generative Artificial Intelligence Profile — NIST (official source)
- NIST Trustworthy and Responsible AI Resource Center (AI RMF Playbook) — NIST (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with National Institute of Standards and Technology (NIST), US Department of Commerce.
